UDAP vs UDAAP chart: two laws, three tests and who enforces each

UDAP and UDAAP are two overlapping laws. UDAP is section 5 of the Federal Trade Commission Act, which prohibits unfair or deceptive acts or practices in commerce. UDAAP is sections 1031 and 1036 of the Dodd-Frank Act, which prohibit unfair, deceptive or abusive acts or practices in consumer financial products and services. For a bank the unfair and deceptive tests are, in the regulators' words, substantially similar under both; abusive exists only under Dodd-Frank. What differs most is enforcement: the FTC cannot enforce section 5 against banks, the CFPB cannot enforce it at all, and the $10 billion asset line decides whether the CFPB or the bank's prudential regulator enforces UDAAP. A compliance review that tests a claim against one law and not the other is half done, which is why Botminds' UDAAP Risk Assessment classifies every risk it finds under section 5 and under sections 1031 and 1036, with the passage behind it, for a compliance officer to decide.

What is the difference between UDAP and UDAAP?

The difference is one word and the agencies behind it. UDAP comes from the FTC Act of 1914 as amended; its unfairness test was set out in the FTC's 1980 policy statement and written into the Act in 1994, and its deception test comes from the FTC's 1983 policy statement. UDAAP comes from the Dodd-Frank Act of 2010, which made it unlawful for "any covered person or service provider ... to engage in any unfair, deceptive, or abusive act or practice" (12 U.S.C. 5536) and gave the new CFPB authority to write rules about it.

The FDIC, whose procedures cover both, says the "legal standards for 'unfair' and 'deceptive' under Section 5 of the FTC Act and the Dodd-Frank Act are substantially similar", and that "the legal standards for unfair, deceptive, or abusive are independent of each other" (FDIC Consumer Compliance Examination Manual, VII-1). In practice that means a misleading fee headline is usually both a UDAP and a UDAAP issue, while an exit designed to keep customers from leaving may be a UDAAP issue only, as abusive.

The bank regulators did not invent their own versions. The OCC says its standards for unfair and deceptive practices "are derived from the principles in the FTC's policy statements and communicated in OCC Advisory Letter 2002-3" (OCC Comptroller's Handbook, UDAP and UDAAP), and the FDIC says it "applies the same standards as the FTC in determining whether an act or practice is unfair." FTC policy statements more than forty years old are still the working definitions a bank examiner uses in 2026, under either law.

Does the FTC Act apply to banks?

Its prohibition does; the FTC's power to enforce it does not. Section 5(a)(2) empowers the FTC to prevent unfair or deceptive practices by "persons, partnerships, or corporations, except banks, savings and loan institutions described in section 57a(f)(3) of this title, Federal credit unions described in section 57a(f)(4) of this title" and certain others (15 U.S.C. 45). The bank regulators fill the gap. In 2004 the Federal Reserve and the FDIC wrote that they "each have affirmed their authority under section 8 of the Federal Deposit Insurance Act to take appropriate action when unfair or deceptive acts or practices are discovered" (Federal Reserve and FDIC, 2004).

Current orders show the same route. The FDIC's April 2025 orders against Discover Bank found "violations of, among other things, Section 5, including the unfair acts or practices of the Bank" and were issued under section 8(b) of the FDI Act (FDIC, Discover Bank orders). The OCC's consent order with The Federal Savings Bank, signed in April 2026, cites cease-and-desist authority under "12 U.S.C. § 1818(b)" for "violations of Section 5 of the Federal Trade Commission Act" (OCC, AA-ENF-2025-63). Dodd-Frank also removed the banking agencies' power to write UDAP rules under section 18(f) of the FTC Act, and with it credit practices rules such as Regulation AA; the FDIC's procedures note that the agencies said in 2014 that the repeal does not make those practices permissible (15 U.S.C. 57a, notes).

Which agencies enforce UDAP and UDAAP at banks?

The bank's prudential regulator enforces UDAP at every size; UDAAP depends on $10 billion in total assets. The OCC states the split for national banks in one paragraph: it has "supervisory and enforcement authority for the UDAP provisions in section 5 of the FTC Act for all OCC-supervised banks" and "supervisory and exclusive enforcement authority for the UDAAP provisions in sections 1031 and 1036 of Dodd–Frank for banks with total assets of $10 billion or less" (OCC Comptroller's Handbook, UDAP and UDAAP). Above $10 billion the CFPB has "exclusive supervisory authority and primary enforcement authority" for UDAAP. The FDIC describes the same split for state nonmember banks.

"The CFPB does not have supervisory or enforcement authority over the UDAP provisions of section 5 of the FTC Act."

OCC Comptroller's Handbook, UDAP and UDAAP, v1.1

The statute behind the split is short. For banks and credit unions over $10 billion, "the Bureau shall have primary authority to enforce that Federal consumer financial law" (12 U.S.C. 5515), with a back-up: another agency may refer a case and act itself if the CFPB does not begin a proceeding within 120 days. For institutions of $10 billion or less, the prudential regulator "shall have exclusive authority (relative to the Bureau) to enforce such laws" (12 U.S.C. 5516). So a community bank's UDAAP risk is enforced by the same examiner who rates its compliance management system.

Is abusive only under Dodd-Frank?

Yes. The FTC Act has no abusive standard; it was created by section 1031(d) of Dodd-Frank, which defines it as material interference with a consumer's ability to understand a term, or unreasonable advantage of a lack of understanding, an inability to protect one's interests, or reasonable reliance (12 U.S.C. 5531). The FDIC points out the structural difference: "Unlike the standards for unfair or deception under Section 5 of the FTC Act, where all prongs of the test must be met for there to be a violation, the abusive standard lays out individual, stand-alone tests to determine if an act or practice is abusive."

The CFPB's 2023 policy statement on abusive practices was withdrawn on May 12, 2025 (90 FR 20084), but the standard was not, and the CFPB's November 2025 examination manual still sets it out (CFPB Supervision and Examination Manual). One small sign of how quickly the guidance layer moves: the OCC's December 2024 booklet, still current, refers readers to "the CFPB's 'Policy Statement on Abusive Acts or Practices' for more information", a document the CFPB withdrew five months later.

Does UDAAP apply to credit unions?

Yes. Dodd-Frank's prohibition binds any covered person offering consumer financial products, and its enforcement sections name "an insured credit union with total assets of more than $10,000,000,000" alongside banks for CFPB supervision, and insured credit unions of $10 billion or less for enforcement by their prudential regulator, which the statute defines as the NCUA (12 U.S.C. 5515; 5516). Federal credit unions, like banks, are outside the FTC's own section 5 jurisdiction.

Can a state attorney general enforce UDAAP?

Yes, with one limit that matters for national banks. Section 1042 lets a state attorney general bring an action "to enforce provisions of this title or regulations issued under this title", but provides that an attorney general "may not bring a civil action in the name of such State against a national bank or Federal savings association to enforce a provision of this title", except to enforce a regulation the CFPB has issued (12 U.S.C. 5552). States also have their own UDAP statutes; in the 2004 statement the Federal Reserve and the FDIC noted that "state authorities have primary responsibility for enforcing state statutes against unfair or deceptive acts or practices."

States used that room in 2025. After the CFPB dismissed its January 2025 lawsuit against Capital One over its 360 Savings accounts, New York's Attorney General sued the bank in May 2025, alleging it marketed the accounts as "high interest" while keeping their rates low (New York Attorney General, May 14, 2025). The year's other cases are in UDAAP enforcement actions 2025.

Is UDAAP a regulation?

No. UDAAP is a statutory prohibition. Section 1031 gives the CFPB authority to write rules identifying unfair, deceptive or abusive practices, but the working law of UDAAP for a bank is the statute, the examination manuals of the CFPB, the OCC, the FDIC and the Federal Reserve, and enforcement orders. That is why examiners apply it case by case, on the facts of each product, and why a bank cannot satisfy it with a checklist of required disclosures. Regulation DD and Regulation E sit beside it: a screen can comply with both and still be deceptive, as the UDAAP 3 part test explains.

What the chart means for one review in UDAAP Risk Assessment

It decides which examiner reads the file and which standards each note must meet. Take a sample journey from the solution; the data are fictional. Tessaly Community Bank, the sample sponsor bank, prepares its examiner pack for "the FDIC and the state banking regulator", which places it among state-chartered banks the FDIC examines. Each of the six risks the agents found on a fintech partner's Early Pay journey is classified under the FTC Act and under Dodd-Frank, with the OCC's handbook cited for the standards, and two are rated abusive, a classification only Dodd-Frank supports.

A note tested under the FTC Act and Dodd-Frank, with the wording the partner must use

The pack itself is the last link in the chain. It gathers every version's screens, each note with its sources, the decisions and signatures, the change requests and the agent versions behind each statement, with personal data masked and confidential flags left out. Whether the reader is the FDIC under section 5 or a state regulator under its own law, the evidence is the same. To see the classification and the pack on a journey of your own, start from UDAAP Risk Assessment.

An examiner pack for the FDIC and the state regulator, in one export

Questions people ask

Is it UDAP or UDAAP?

Both terms are correct and refer to different laws. UDAP is the FTC Act's prohibition on unfair or deceptive practices; UDAAP is Dodd-Frank's, which adds abusive. Bank examiners usually test for both, and the OCC's booklet covers both in one volume.

What is UDAP in banking?

It is section 5 of the FTC Act as applied to banks by their own regulators. The FTC itself cannot bring a section 5 case against a bank, so the OCC, the FDIC and the Federal Reserve enforce it through section 8 of the FDI Act, as the FDIC's 2025 Discover Bank orders and the OCC's 2026 Federal Savings Bank order show.

Does the CFPB enforce UDAP?

No. The CFPB enforces UDAAP under Dodd-Frank, and the OCC's handbook states that the CFPB "does not have supervisory or enforcement authority" over section 5 of the FTC Act. The unfair and deceptive tests it applies are substantially similar, so the difference is mostly the label and the agency.

Does UDAAP apply to business accounts?

Dodd-Frank's prohibition is about consumer financial products and services, so a purely business product is generally outside it. Section 5 of the FTC Act is broader: the FDIC's Discover Bank orders found section 5 unfairness in fees charged to merchants.

Who enforces UDAAP at a bank with $5 billion in assets?

Its prudential regulator, which Dodd-Frank defines as the appropriate federal banking agency, exclusively relative to the CFPB: the OCC for a national bank, the FDIC for a state nonmember bank, the Federal Reserve for a state member bank. The CFPB can refer a matter to that regulator in writing, and the regulator must respond within 60 days.